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DETAILED ACTION 

This action is in response to an Amendment filed March 10, 2005. Claims 1-47 are presented for 
further consideration. 

Response to Arguments 

Claim rejections, see Remarks/ Arguments I, with respect to claims 25-26, and 28 under 
35 USC 1 12, second paragraph are withdrawn. 

Applicant's arguments with respect to claims 14-29 have been considered but are moot in 
view of the new grounds of rejection. 

In considering the Applicant's arguments the following factual remarks are noted: 
(I) Applicant contends that Fishman fails to teach or suggest an identifier associated with 
each record event, including updating only a portion of the statistical model associated with the 
identifier. 

In considering (I), Applicant contends that Fishman fails to teach or suggest an identifier 
associated with each record event, including updating only a portion of the statistical model 
associated with the identifier. Examiner respectfully disagrees. As asserted by Applicant, 
Fishman discloses a method for building predictive models, wherein the models are updated by 
processing the new transactional records only , (abstract; paragraph [0008]). Examiner further 
asserts that Fishman explicitly discloses that the aforementioned transactional records (i.e. record 
event) are associated with an identifier, (i.e. customer identifier/attribute; paragraphs [0021]- 
[0023];Figure 1- CustlT). These records are observed by different transactional sources, wherein 
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each transactional source contains records associated with an identical identifier (i.e. m,; 
paragraphs [0017]-[0020]). Examiner cites Figure 1, which expressly displays that each of 
aforementioned transactional sources (i.e. demographic customer data 10; click through log 12; 
and purchase table 14) include various observed records (i.e. age; data; pageED; productID) that 
all correspond to the identical share identifier, (i.e. cust!7). Fishman further discloses that when 
a new transactional record becomes present, that the predictive model method updates the 
records contained in these transactional sources, which correspond to a specified common 
identifier (i.e. t m { ; paragraphs [0037]-[0041]; Figure 2-item 24). In the case which in the 
previous cited example, the method processes and updates all records that correspond to 
observations for customer 17 by processing each transactional source of data separately for that 
common identifier (paragraph [0024]). Therefore, Examiner asserts that the predictive model as 
disclosed by Fishman shows the limitations of Applicant's invention, specifically an identifier 
associated with each record event including updating only a portion of the statistical model 
associated with the identifier as set forth below in the office action. 
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Claim Rejections - 35 USC §103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

Claims 1-2, 37-38, and 45 are rejected under 35 U.S.C. 103(a) as being anticipated by 
Porras et al. (US Patent 6,321,338) in view of Fishman et al. (US Patent Application 
Publication 2001/0037321), hereinafter referred to as Porras and Fishman. 

In reference to claim 1, Porras discloses a method for network surveillance that includes 
real-time measuring and monitoring of network traffic, in order to subsequently generate 
network statistical profiles (abstract). Porras explicitly discloses: 

• A method for analyzing a stream of usage data, (column 1, lines 44-54; column 4, line 60 to 
column 5, line 3;column 5, line 30-52; and column 3, lines 42-54), comprising: 

• Generating a statistical model (i.e. statistical profile) from a set of record events, (column 
4, line 60 to column 5, line 3 and column 5, line 30-52); 

• Receiving a most recent record event, (column 2, lines 1 1-18 and column 6, lines 37-52); 
and 

• Updating the statistical model using the most recent event by adding the most recent 
record to the statistical model, (column 2, lines 1 1-18 and column 6, lines 37-52). 
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Although Porras disclose substantial features of the claimed invention, the reference fails to 
explicitly disclose: an identifier is associated with each record event, including only a portion of 
the statistical model associated with the identifier. Nonetheless, these would have been an 
obvious modifications to the aforementioned method to one of ordinary skill in the art at the time 
of the invention, as further evidenced by Fishman. 

In an analogous art, Fishman discloses a method for generating statistical models, in which 
the aforementioned model is updated by processing only the newly available records, (paragraph 
[0008], lines 1-18; paragraph [0010], lines 1-5; and abstract). Fishman further discloses that the 
transactional records (i.e. record event) are associated with an identifier, (i.e. customer 
identifier/attribute; paragraphs [0021]-[0023];Figure 1- CustlT), and further that the predictive 
model method updates the records, which correspond to a specified common identifier (i.e. t m i ; 
paragraphs [0037]-[0041]; Figure 2-item 24). One of ordinary skill in the art would have been so 
motivated to implement this modification into the aforementioned method in order to quickly 
update the model, thereby improving processing speed (Fishman paragraph [0037], lines 1-3). 

In reference to claim 37, Porras explicitly discloses a system for employing the 
aforementioned method, (column 2, lines 2-10 and Figure 2). Porras explicitly shows: 
• A network usage analysis system for analyzing a stream of network usage data, (column 2, 

lines 2-10;column 1, lines 44-54; column 4, line 60 to column 5, line 3;column 5, line 30-52; 

and column 3, lines 42-54) comprising: 

• A data analysis server (i.e. monitor) which generates a statistical model (i.e. statistical 
profile) from a set of usage data record events, and upon receiving a most recent record 
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event, the data analysis system server updates the statistical model using the most recent 
record event by adding the most recent record event to the statistical model, (column 3, 
lines 32-54; column 4, line 48 to column 5, line 3; column 2, lines 1 1-18 and column 6, 
lines 37-52). 

Although Porras disclose substantial features of the claimed invention, the reference fails to 
explicitly disclose: an identifier is associated with each record event, including only a portion of 
the statistical model associated with the identifier. Nonetheless, these would have been an 
obvious modifications to the aforementioned system to one of ordinary skill in the art at the time 
of the invention, as further evidenced by Fishman. 

In an analogous art, Fishman discloses a method for generating statistical models, in which 
the aforementioned model is updated by processing only the newly available records, (paragraph 
[0008], lines 1-18; paragraph [0010], lines 1-5; and abstract). Fishman further discloses that the 
transactional records (i.e. record event) are associated with an identifier, (i.e. customer 
identifier/attribute; paragraphs [0021]-[0023]; Figure 1- CustlT), and further that the predictive 
model method updates the records, which correspond to a specified common identifier (i.e. t m i ; 
paragraphs [0037]-[0041]; Figure 2-item 24). One of ordinary skill in the art would have been so 
motivated to implement this modification into the aforementioned system in order to quickly 
update the model, thereby improving processing speed (Fishman paragraph [0037], lines 1-3). 

All subsequent system claims will be discussed with the appropriately associated method 

claims. 
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In reference to claim 45, Porras explicitly discloses a computer program product on a 
computer readable medium for employing the aforementioned method, (column 2, lines 25-35). 
Porras explicitly shows: 

• A computer readable medium having computer executable instructions for performing a 
method for analyzing a stream of network data, (column 2, lines 25-35; column 1, lines 44- 
54; column 4, line 60 to column 5, line 3;column 5, line 30-52; and column 3, lines 42-54) 
the method comprising: 

• Generating a statistical model (i.e. statistical profile) from a set of record events, (column 
4, line 60 to column 5, line 3 and column 5, line 30-52); 

• Receiving a most recent record event, (column 2, lines 1 1-18 and column 6, lines 37-52); 
and 

• Updating the statistical model using the most recent event by adding the most recent 
record to the statistical model, (column 2, lines 11-18 and column 6, lines 37-52). 

Although Porras disclose substantial features of the claimed invention, the reference fails to 
explicitly disclose: an identifier is associated with each record event, including only a portion of 
the statistical model associated with the identifier. Nonetheless, these would have been an 
obvious modifications to the aforementioned system to one of ordinary skill in the art at the time 
of the invention, as further evidenced by Fishman. 

In an analogous art, Fishman discloses a method for generating statistical models, in which 
the aforementioned model is updated by processing only the newly available records, (paragraph 
[0008], lines 1-18; paragraph [0010], lines 1-5; and abstract). Fishman further discloses that the 
transactional records (i.e. record event) are associated with an identifier, (i.e. customer 
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identifier/attribute; paragraphs [0021]-[0023]; Figure 1- CustlT), and further that the predictive 
model method updates the records, which correspond to a specified common identifier (i.e. /mi ; 
paragraphs [0037]-[0041]; Figure 2-item 24). One of ordinary skill in the art would have been so 
motivated to implement this modification into the aforementioned system in order to quickly 
update the model, thereby improving processing speed (Fishman paragraph [0037], lines 1-3). 

All subsequent system claims will be discussed with the appropriately associated method 

claims. 

In reference to claims 2 and 38, Porras explicitly shows the limitations, (column 6, lines 

47-50). 

Claim 13 is rejected under 35 U.S.C 103(a) as being unpatentable over Porras et aL (US 
Patent 6,321,338) and further in view of Sarkissian et al (US Patent 6,771,646) and 
Fishman (US Patent Application Publication 2001/0037321), hereinafter referred to as 
Porras and Sarkissian and Fishman, respectively. 

In reference to claim 13, Porras discloses a method for network surveillance that includes 
real-time measuring and monitoring of network traffic, in order to subsequently generate 
network statistical profiles (abstract), Porras explicitly discloses: 

• A method for analyzing a stream of data over a rolling time (i.e. short-term or long-term) 
interval comprising, (column 1, lines 44-54; column 4, line 60 to column 5, line 3;column 5, 
line 30-52; and column 3, lines 42-54): 
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• Defining a statistical model for analyzing the stream of data over the rolling time interval, 
(column 5, lines 30-52 and column 6, lines 38-52); 

• Defining the rolling time interval to include a plurality of update intervals, (column 2, lines 
11-19 and column 5, lines 30-35; column 6, lines 38-52); 

• Receiving a record event from the stream of data for each update time interval, (column 2, 
lines 11-19 and column 5, lines 30-35; column 6, lines 38-52); 

• Generating the statistical model over the rolling time interval using the statistical model and 
each record event, (column 2, lines 11-19 and column 5, lines 30-35; column 6, lines 38-52); 
and 

• Updating the statistical model using the statistical model and a most recent record event for a 
most recent update time interval, (column 2, lines 1 1-18 and column 6, lines 37-52). 

In an art, Sarkissian discloses a method that involves employing a cache subsystem for 
storing flow-based statistical measures, and subsequent supports real-time network monitoring 
(column 2, lines 30-32; column 2, lines 50-67; column 3, lines 1-15; column 4, line 54 to column 
5, line 24; and column 19, line 55 to column 20, line 2). One of ordinary skill in the art would 
have been so motivated to implement this into feature into the aforementioned methodology as 
disclosed by Porras, so as to reduce latency time associated with memory accesses thereby 
improving process efficiency, (Sarkissian column 2, lines 57-67). 

The references, Porras and Sarkissian fail to disclose updating only a portion of the 
statistical model associated with the most recent record event. Nonetheless, this would have been 
an obvious modification to the aforementioned method to one of ordinary skill in the art at the 
time of the invention, as further evidenced by Fishman. 
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In another analogous art, Fishman discloses a method for generating statistical models, in 
which the aforementioned model is updated by processing only the newly available records, 
(paragraph [0008], lines 1-18; paragraph [0010], lines 1-5; and abstract). One of ordinary skill in 
the art would have been so motivated to implement this modification into the aforementioned 
method in order to quickly update the model, thereby improving processing speed (Fishman 
paragraph [0037], lines 1-3). 

Claim 23 are rejected under 35 U.S.C. 103(a) as being unpatentable over Porras et al. (US 
Patent 6,321,338), and in view of Sarkissian et al (US Patent 6,771,646), and further in view 
of Kawasaki (US Patent 6,539,375) and Fishman et al. (US Patent Application Publication 
2001/0037321), hereinafter referred to as Porras Sarkissian, Kawasaki, and Fishman 
respectively. 

In reference to claim 23, Porras discloses a method for network surveillance that includes 
real-time measuring and monitoring of network traffic, in order to subsequently generate 
network statistical profiles (abstract). Porras explicitly discloses: 

• A method for analyzing a stream of network usage data over a rolling time (i.e. short-term or 
long-term) interval comprising, (column 1, lines 44-54; column 4, line 60 to column 5, line 
3;column 5, line 30-52; and column 3, lines 42-54): 

• Defining a statistical model for analyzing the stream of network usage data over the 
rolling time interval, (column 5, lines 30-52 and column 6, lines 38-52); 

• Defining the rolling time interval to include a plurality of update intervals, (column 2, lines 
1 1-19 and column 5, lines 30-35; column 6, lines 38-52); 
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• Receiving a record event from the stream of data for each update time interval, (column 2, 
lines 11-19 and column 5, lines 30-35; column 6, lines 38-52); 

• Generating the statistical model over the rolling time interval using the statistical model and 
each record event, (column 2, lines 11-19 and column 5, lines 30-35; column 6, lines 38-52); 
and 

• Updating the statistical model using the statistical model and a most recent record event for a 
most recent update time interval, (column 2, lines 11-18 and column 6, lines 37-52). 

Although Porras disclose substantial features of the claimed invention, the reference fails to 
explicitly disclose: storing the record event for each update in a history cache; and generating a 
statistical model each record event stored in the history cache. Nonetheless, this would have been 
an obvious modification to the aforementioned method to one of ordinary skill in the art at the 
time of the invention, as further evidenced by Sarkissian. 

In an analogous art, Sarkissian discloses a method that involves employing a cache 
subsystem for storing flow-based statistical measures, and subsequent supports real-time network 
monitoring (column 2, lines 30-32; column 2, lines 50-67; column 3, lines 1-15; column 4, line 
54 to column 5, line 24; and column 19, line 55 to column 20, line 2). One of ordinary skill in the 
art would have been so motivated to implement this into feature into the aforementioned 

c 

methodology as disclosed by Porras, so as to reduce latency time associated with memory 
accesses thereby improving process efficiency, (Sarkissian column 2, lines 57-67). In addition, 
the references fail to disclose: each record event set including one or more record events, 
wherein each record event is associated with a user identifier. Nonetheless, this would have been 



Application/Control Number: 09/919,527 Page 12 

Art Unit: 2153 

an obvious modification to the aforementioned method to one of ordinary skill in the art at the 
time of the invention, as further evidenced by Kawasaki. 

In another analogous art, Kawasaki discloses associating record events to a use 
identification (i.e. user profile), used in a method for tracking network (i.e. Internet) usage of 
users, (column 2, lines 47-54; column4, lines 42-61). This modification to the aforementioned 
method would have been obvious, because one of ordinary skill in the art would have been so 
motivated to identifier specific users in order to further correlate network activity records thereby 
improving detection of abnormal network activity, (Porras column 2, lines 54-64). In addition, 
the references fail to disclose updating only a portion of the statistical model associated with the 
most recent record event. Nonetheless, this would have been an obvious modification to the 
aforementioned method to one of ordinary skill in the art at the time of the invention, as further 

evidenced by Fishman. 

In another analogous art, Fishman discloses a method for generating statistical models, in 
which the aforementioned model is updated by processing only the newly available records, 
(paragraph [0008], lines 1-18; paragraph [0010], lines 1-5; and abstract). One of ordinary skill in 
the art would have been so motivated to implement this modification into the aforementioned 
method in order to quickly update the model, thereby improving processing speed (Fishman 
paragraph [0037], lines 1-3). 

Claims 29-36 are rejected under 35 U.S.C. 103(a) as being unpatentable over Porras et al. 
(US Patent 6,321,338), and in view of Sarkissian et ah (US Patent 6,771,646), and further in 
view of Fishman et al. (US Patent Application Publication 2001/0037321), Costa (US Patent 
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6,138,121), and Aboulnaga et ah (US Patent 6,460,045), hereinafter referred to as Porras 
Sarkissian, Fishman, Costa, and respectively Aboulnaga. 

In reference to claim 29, Porras discloses a method for network surveillance that includes 
real-time measuring and monitoring of network traffic, in order to subsequently generate 
network statistical profiles (abstract). Porras explicitly discloses: 

• A method for analyzing a stream of network usage data over a rolling time (i.e. short-term or 
long-term) interval comprising, (column 1, lines 44-54; column 4, line 60 to column 5, line 
3;column 5, line 30-52; and column 3, lines 42-54): 

• Defining a statistical model for analyzing the stream of network usage data over the 
rolling time interval, (column 5, lines 30-52 and column 6, lines 38-52); 

• Defining the rolling time interval to include a plurality of update intervals, (column 2, 
lines 1 1-19 and column 5, lines 30-35; column 6, lines 38-52); 

• Receiving a record event from the stream of data for each update time interval, (column 
2, lines 1 1-19 and column 5, lines 30-35; column 6, lines 38-52); 

• Generating the statistical model over the rolling time interval using the statistical model 
and each record event, (column 2, lines 11-19 and column 5, lines 30-35; column 6, lines 
38-52); and 

• Updating the statistical model using the statistical model and a most recent record event 
for a most recent update time interval, (column 2, lines 11-18 and column 6, lines 37-52). 

Although Porras disclose substantial features of the claimed invention, the reference fails to 
explicitly disclose: storing the record event for each update in a history cache; and generating a 
statistical model each record event stored in the history cache. Nonetheless, this would have been 
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an obvious modification to the aforementioned method to one of ordinary skill in the art at the 
time of the invention, as further evidenced by Sarkissian. 

In an analogous art, Sarkissian discloses a method that involves employing a cache 
subsystem for storing flow-based statistical measures, and subsequent supports real-time network 
monitoring (column 2, lines 30-32; column 2, lines 50-67; column 3, lines 1-15; column 4, line 
54 to column 5, line 24; and column 19, line 55 to column 20, line 2). One of ordinary skill in the 
art would have been so motivated to implement this into feature into the aforementioned 
methodology as disclosed by Porras, so as to reduce latency time associated with memory 
accesses thereby improving process efficiency, (Sarkissian column 2, lines 57-67). In addition, 
the references fail to disclose generating an aggregation table. Nonetheless, this would have 
been an obvious modification to the aforementioned method to one of ordinary skill in the art at 
the time of the invention, as further evidenced by Costa. 

In another analogous art, Costa discloses a method for network management in which an 
aggregation table is employed for tracking system data and generating statistical reports, (column 
2, lines 21-31; column 8, lines 1-41; column 8, lines 53 to column 9, line 5). One of ordinary 
skill in the art would have been so motivated to implement this modification into the 
aforementioned method, so as to increase the ease of performing various actions (e.g.. access, 
aggregate, extract, etc.) On relevant statistical data thereby increasing process efficiency, (Costa 
column 2, lines 15-18). In addition, the references fail to disclose updating only a portion of the 
statistical model associated with the most recent record event. Nonetheless, this would have been 
an obvious modification to the aforementioned method to one of ordinary skill in the art at the 
. time of the invention, as further evidenced by Fishman. 
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In another analogous art, Fishman discloses a method for generating statistical models, in 
which the aforementioned model is updated by processing only the newly available records, 
(paragraph [0008], lines 1-18; paragraph [0010], lines 1-5; and abstract). One of ordinary skill in 
the art would have been so motivated to implement this modification into the aforementioned 
method in order to quickly update the model, thereby improving processing speed (Fishman 
paragraph [0037], lines 1-3). In addition, although the references show substantial features to the 
claimed invention, the references fail to show explicitly the method generating a histogram 
statistical model representative of the network data, wherein the histogram having a first axis 
illustrating total usage defined by a number of bins, each bin having a usage variable range, and 
a second axis defined by a frequency corresponding to a number of users having a total usage 
within the usage variable range of each bin. Nonetheless, histogram statistical models were well 
known in the art at the time of the invention, as further evidenced by Aboulnaga. Therefore, this 
limitation would have been an obvious modification to the aforementioned method, as disclosed 
by the references, for one of ordinary skill in the art. 

In an analogous art, Aboulnaga discloses a method of building histogram statistical 
models, (column 5, line 37 to column 6, line 3). Aboulanga further shows building a histogram 
that includes a first axis defined a number of bins (i.e. bins; Figure 6-BUCKETS), each bin 
having a variable range (i.e. high to low; Figure 3; column 6, lines 30-55) and a second axis 
defined by a frequency (Figure 3&6) within the variable range of each bin, (columns 5-10). This 
modification would have been obvious to one of ordinary skill in the art, so as to increase the 
accuracy of the statistical model estimations and thereby increasing process effectiveness, 
(Aboulnaga column 1, lines 54-55). 
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In reference to claim 30, Porras, Sarkissian, Fishman, and Costs and Fishman explicitly 
show the limitations, (Fishman paragraph [0008], lines 1-18; paragraph [0010], lines 1-5; and 
abstract). 

In reference to claims 31-36 Porras, Sarkissian, Fishman, and Costa explicitly show the 
limitations, (Porras column 2, lines 1 1-19 and column 5, lines 30-35; column 6, lines 38-52; and 
Sarkissian column 2, lines 30-32; column 2, lines 50-67; column 3, lines 1-15; column 4, line 54 
to column 5, line 24; and column 19, line 55 to column 20, line 2). 

Claims 3 and 39 are rejected under 35 U.S.C. 103(a) as being unpatentable over Porras as 
applied to claims above, and further in view of Steinbiss et al. (US Patent 6,823,307), 
hereinafter referred to as Steinbiss. 

In reference to claim 3 and 39, although Porras and Fishman disclose substantial features 
of the aforementioned method, the references fail to explicitly disclose the method further 
comprising the step of: storing the set of records in a history cache, and wherein if the history 
cache is full, updating the statistical model includes removing a least recent event from the 
statistical model. Nonetheless, this would have been an obvious modification to the 
- aforementioned method, to one of ordinary skill in the art at the time of the invention, as further 
evidenced by Steinbiss. 

In an analogous art, Steinbiss discloses a method for employing stochastic models that 
involves storing recently recognized elements in a cache, (abstract; column 2, lines 25-38; and 
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column 5, lines 15-30). Steinbiss further discloses once the cache is full, removing the least 
recently stored element, (column 5, line 60 to column 6, line 7). This modification would have 
been obvious, because one of ordinary skill in the art would have been so motivated to 
implement this feature so as to maximize available memory space, thereby reducing cost 
associated with larger capacity cache memories, (Steinbiss column 5, line 66 to column 6, line 

3). 



Claims 4 and 40 are rejected under 35 U.S.C 103(a) as being unpatentable over Porras, 
Fishman, and Steinbiss as applied to claims above, and further in view of Sarkissian et ah 
(US Patent 6,771,646), hereinafter referred to as Sarkissian. 

In reference to claims 4 and 40, Porras, Fishman, and Sarkissian disclose substantial 
features of the claimed invention, specifically the statistical model (i.e. statistical profile) 
including an aggregation of each event record set, (Porras column 6, lines 38-52). However the 
references fail to explicitly disclose: generating a statistical model each record event stored in the 
history cache. Nonetheless, this would have been an obvious modification to the aforementioned 
method to one of ordinary skill in the art at the time of the invention, as further evidenced by 
Sarkissian. 

In an analogous art, Sarkissian discloses a method that involves employing a 
cache subsystem for storing flow-based statistical measures, and subsequent supports real-time 
network monitoring (column 2, lines 30-32; column 2, lines 50-67; column 3, lines 1-15; column 
4, line 54 to column 5, line 24; and column 19, line 55 to column 20, line 2). One of ordinary 
skill in the art would have been so motivated to implement this into feature into the 
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aforementioned methodology, so as to reduce latency time associated with memory accesses 
thereby improving process efficiency, (Sarkissian column 2, lines 57-67). 

Claims 5-6, 8-10, 12, and 41-43 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Porras, Fishman, Steinbiss, and Sarkissian as applied to claims above, and further in 
view of Costa et al. (US Patent 6,138,121), hereinafter referred to as Costa, 

In reference to claims 5 and 41, Porras, Fishman, Steinbiss, and Sarkissian show 
substantial features of the claimed invention. However, the references fail to show the method 
wherein generating a statistical model from the set pf record events includes generating an 
aggregation table for tracking and aggregation of record events associated with an identifier. 
Nonetheless, this modification to the aforementioned method, as disclosed by the references, 
would have been obvious to one of ordinary skill in the art at the invention, as further evidenced 
by Costa. 

In an analogous art, Costa discloses a method for network management in which an 
aggregation table is employed for tracking system data and generating statistical reports, (column 
2, lines 21-31; column 8, lines 1-41; column 8, lines 53 to column 9, line 5). One of ordinary 
skill in the art would have been so motivated to implement this modification into the 
aforementioned method, so as to increase the ease of performing various actions (e.g. access, 
aggregate, extract, etc.) on relevant statistical data thereby increasing process efficiency, (Costa 
column 2, lines 15-18). 
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In reference to claims 6 and 42, Porras, Fishman, Steinbiss, Sarkissian, and Costa 
explicitly show the limitations, (Costa column 2, lines 21-31; column 8, lines 1-41; column 8, 
lines 53 to column 9, line 5). 

In reference to claims 8 and 43, the references Porras, Fishman, Steinbiss, Sarkissian, and 
Costa explicitly show the limitations, (Fishman paragraph [0008], lines 1-18; paragraph [0010], 
lines 1-5; and abstract). 

In reference to claims 9 and 44, Porras, Fishman, Steinbiss, Sarkissian, and Costa 
explicitly show the limitations, (Porras column 2, lines 1 1-19 and column 5, lines 30-35; column 
6, lines 38-52 and Costa column 2, lines 21-31; column 8, lines 1-41; column 8, lines 53 to 
column 9, line 5). 

* 

In reference to claim 10, Porras, Fishman, Steinbiss, Sarkissian, and Costs explicitly 
show the limitations, (Fishman paragraph [0008], lines 1-18; paragraph [0010], lines 1-5; and 
abstract). 

In reference to claim 12 Porras, Fishman, Steinbiss, Sarkissian, and Costa explicitly show 
the limitations, (Sarkissian column 19, line 55 to column 20, line 2). 
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Claims 7, 11, and 14-22 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Porras, Fishman, Steinbiss, Sarkissian, and Costa as applied to claims above, and further 
in view of Aboulnaga et al. (US Patent 6,460,045), hereinafter referred to as Aboulnaga* 

In reference to claims 7 and 1 1, although Porras, Steinbiss, Sarkissian, and Costa show 
substantial features to the claimed invention, the references fail to show explicitly the method 
generating a histogram statistical model representative of the network data. Nonetheless, 
histogram statistical models were well known in the art at the time of the invention, as further 
evidenced by Aboulnaga. Therefore, this limitation would have been an obvious modification to 
the aforementioned method, as disclosed by the references, for one of ordinary skill in the art. 

In an analogous art, Aboulnaga discloses a method of building histogram statistical 
models, (column 5, line 37 to column 6, line 3).* This modification would have been obvious to 
one of ordinary skill in the art, so as to increase the accuracy of the statistical model estimations 
and thereby increasing process effectiveness, (Aboulnaga column 1, lines 54-55). 

In reference to claim 14, Porras, Fishman, Steinbiss, Sarkissian, Costs and Aboulnaga 
explicitly show the limitations, (Steinbiss column 5, line 60 to column 6, line 7). 

In reference to claims 15-22, Porras, Fishman, Steinbiss, Sarkissian, Costs and 
Aboulnaga explicitly show the limitations, (Sarkissian column 2, lines 30-32; column 2, lines 
50-67; column 3, lines 1-15; column 4, line 54 to column 5, line 24; and column 19, line 55 to 
column 20, line 2). 
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In reference to claim 46, Porras, Fishman, Steinbiss, Sarkissian, Costs and Aboulnaga 
explicitly show the limitations, as previously addressed for claims 1, 3,4,5,8,1 1,18,19,20,21, and 
29, due to claim 46 reciting the combination of all of the limitations of the aforementioned 
claims. 

In reference to claim 47, Porras, Fishman, Steinbiss, Sarkissian, Costs and Aboulnaga 
explicitly show the limitations (Aboulnaga columns 5-10). 

Claims 8-10, and 43-44 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Porras, Steinbiss, Sarkissian, and Costa as applied to claims above, and further in view of 
Fishman et ah (US Patent Application Publication 2001/0037321), hereinafter referred to as 
Fishman. 

In reference to claims 8 and 43, the references Porras, Steinbiss, Sarkissian, and Costa 
fail to disclose updating only a portion of the statistical model associated with the most recent 
record event. Nonetheless, this would have been an obvious modification to the aforementioned 
method to one of ordinary skill in the art at the time of the invention, as further evidenced by 
Fishman. 

In another analogous art, Fishman discloses a method for generating statistical models, 
in which the aforementioned model is updated by processing only the newly available records, 
One of ordinary skill in the art would have been so motivated to implement this modification into 
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the aforementioned method in order to quickly update the model, thereby improving processing 
speed (Fishman paragraph [0037], lines 1-3). 

* 

In reference to claims 9 and 44, Porras, Steinbiss, Sarkissian, Costs and Fishman 
explicitly show the limitations, (Porras column 2, lines 11-19 and column 5, lines 30-35; column 
6, lines 38-52 and Costa column 2, lines 21-31; column 8, lines 1-41; column 8, lines 53 to 
column 9, line 5). 

In reference to claims 10 and 30, Porras, Steinbiss, Sarkissian, Costs and Fishman 
explicitly show the limitations, (Fishman paragraph [0008], lines 1-18; paragraph [0010], lines 1- 
5; and abstract). 

Claim 24 is rejected under 35 U.S.C. 103(a) as being unpatentable over Porras Sarkissian, 
Kawasaki, and Fishman as applied to the claims above, and further in view of Steinbiss et 
al. (US Patent 6,823,307), hereinafter referred to as Steinbiss. 

In reference to claim 24, although Porras, Sarkissian, Kawasaki, and Fishman disclose 
substantial features of the aforementioned method, the references fail to explicitly disclose the 
method further comprising the step of: wherein if the history cache is full, updating the statistical 
model includes removing a least recent event from the statistical model. Nonetheless, this would 
have been an obvious modification to the aforementioned method, to one of ordinary skill in the 
art at the time of the invention, as further evidenced by Steinbiss. 
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In an analogous art, Steinbiss discloses a method for employing stochastic models that 
involves storing recently recognized elements in a cache, (abstract; column 2, lines 25-38; and 
column 5, lines 15-30). Steinbiss further discloses once the cache is full, removing the least 
recently stored element, (column 5, line 60 to column 6, line 7). This modification would have 
been obvious, because one of ordinary skill in the art would have been so motivated to 
implement this feature so as to maximize available memory space, thereby reducing cost 
associated with larger capacity cache memories, (Steinbiss column 5, line 66 to column 6, line 

3). 



Claims 25-26 are rejected under 35 U.S.C. 103(a) as being unpatentable over Porras, 
Sarkissian, Kawasaki, and Fishman as applied to claims above, and further in view of 
Costa et al. (US Patent 6, 138,121), hereinafter referred to as Costa. 

In reference to claim 25, Porras, Sarkissian, Kawaski, show substantial features of the 
invention, but fail to show limitations. However, the references fail to show the method wherein 
generating a statistical model from the set of record events includes generating an aggregation 
table for tracking and aggregation of each record event set stored in the history cache for each 
user identifier. Nonetheless, this modification to the aforementioned method, as disclosed by the 
references, would have been obvious to one of ordinary skill in the art at the invention, as further 
evidenced by Costa. 

In an analogous art, Costa discloses a method for network management in which an 
aggregation table is employed for tracking system data and generating statistical reports, (column 
2, lines 21-31; column 8, lines 1-41; column 8, lines 53 to column 9, line 5). One of ordinary 
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skill in the art would have been so motivated to implement this modification into the 
aforementioned method, so as to increase the ease of performing various actions (e.g. access, 
aggregate, extract, etc.), on relevant statistical data thereby increasing process efficiency, (Costa 
column 2, lines 15-18). 

In reference to claim 26, Porras Sarkissian, Kawasaki, Fishman, and Costa explicitly show the 
limitations, (Fishman paragraph [0008], lines 1-18; paragraph [0010], lines 1-5; and abstract). 

Claims 27-28 are rejected under 35 U.S.C. 103(a) as being unpatentable over Porras, 
Sarkissian, Kawasaki, Fishman, and Costa as applied to claims above, and further in view 
of Aboulnaga et al. (US Patent 6,460,045), hereinafter referred to as Aboulnaga. 

In reference to claim 27, although Porras, Steinbiss, Sarkissian, Kawasaki, Fishman and 
Costa show substantial features to the claimed invention, the references fail to show explicitly 
the method generating a histogram statistical model representative of the network data. 
Nonetheless, histogram statistical models were well known in the art at the time of the invention, 
as further evidenced by Aboulnaga. Therefore, this limitation would have been an obvious 
modification to the aforementioned method, as disclosed by the references, for one of ordinary 
skill in the art. 

In an analogous art, Aboulnaga discloses a method of building histogram statistical 
models, (column 5, line 37 to column 6, line 3). This modification would have been obvious to 
one of ordinary skill in the art, so as to increase the accuracy of the statistical model estimations 
and thereby increasing process effectiveness, (Aboulnaga column 1, lines 54-55). 
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In reference to claim 28, Porras, Steinbiss, Sarkissian, Costa, Fishman, and Aboulnaga 
explicitly show the limitations, (Aboulnaga column 5, line 37 to column 6, line 3 and Fishman 
paragraph [0008], lines 1-18; paragraph [0010], lines 1-5; and abstract). 

Claim 36 is rejected under 35 U.S.C. 103(a) as being unpatentable over Porras, 
Sarkissian, Fishman, and Costa as applied to claims above, and further in view of 
Aboulnaga et al. (US Patent 6,460,045), hereinafter referred to as Aboulnaga* 

In reference to claim 36, although Porras, Sarkissian, Fishman, and Costa show 
substantial features to the claimed invention, the references fail to show explicitly the method 
generating a histogram statistical model representative of the network data. Nonetheless, 
histogram statistical models were well known in the art at the time of the invention, as further 
evidenced by Aboulnaga. Therefore, this limitation would have been an obvious modification to 
the aforementioned method, as disclosed by the references, for one of ordinary skill in the art. 

In an analogous art, Aboulnaga discloses a method of building histogram statistical 
models, (column 5, line 37 to column 6, line 3), This modification would have been obvious to 
one of ordinary skill in the art, so as to increase the accuracy of the statistical model estimations 
and thereby increasing process effectiveness, (Aboulnaga column 1, lines 54-55). 
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Conclusion 



THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 



policy as set forth in 37 CFR 1 .136(a). A shortened statutory period for reply to this final action 



is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply 
is filed within TWO MONTHS of the mailing date of this final action and the advisory action is 
not mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of the 
advisory action. In no event, however, will the statutory period for reply expire later than SIX 
MONTHS from the mailing date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to LaShanya Nash whose telephone number is (571) 272-3957. The 
examiner can normally be reached on 9am-5pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Glenton Burgess can be reached on (571) 272-3949. The fax number for the 
organization where this application or proceeding is assigned is (703) 746-7239. Any inquiry of 
a general nature relating to the status of this application or proceeding should be directed to the 
receptionist whose telephone number is (703) 305-3900. 
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